Vulnerability intelligence

CVE-2026-26980

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

CVSS Score

9.4

Critical

EPSS — Exploit Probability

70%

Riskier than 99% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

6 articles across 5 outlets · first covered May 25, 2026 · latest May 31, 2026

Associated threat actors

Lazarus Group

Coverage timeline

Ghost CMS mass hack via CVE-2026-26980 fuels ClickFix attack wave
securityaffairs.com · May 31, 2026
Global Ghost CMS Poisoning Campaign Exploits Enterprise Blogs
securityonline.info · May 27, 2026
Hackers Hijack 700+ Sites via Ghost CMS SQLi Flaw CVE-2026-26980
www.malwarebytes.com · May 26, 2026
Ghost CMS SQL flaw lets attackers hijack 700+ sites, steal keys
securityaffairs.com · May 25, 2026
Ghost CMS CVE-2026-26980 SQLi Triggers Attack on 700 Sites
www.securityweek.com · May 25, 2026
CVE-2026-26980 flaw hijacks 700+ Ghost sites for click fraud
thehackernews.com · May 25, 2026